Tapeline MCP Server

This is a pre-launch quantitative trading platform with a reasonably well-structured backend and frontend. The codebase demonstrates good security practices in most areas (proper auth architecture, credential handling via environment variables, sensible dependency management), but has several moderate-severity concerns: environment variables are passed through API responses in at least one path, email rendering includes user data in URLs without clear validation, and critical files are truncated preventing full analysis. The permissions align well with the stated purpose (financial data APIs, database access, email delivery), but incomplete visibility into the full codebase and these credential-handling patterns lower confidence. Supply chain analysis found 10 known vulnerabilities in dependencies (0 critical, 4 high severity).

4 files analyzed · 16 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.